From 691dc742362eeec45d5bd32d2b468f31a959748e Mon Sep 17 00:00:00 2001 From: tegwick Date: Sat, 17 Oct 2026 04:23:03 +0200 Subject: [PATCH] docs(recovery): deliver isolated original consumer custody plan Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a1468b-63fa-7710-85dc-8f2e16b3ebfa --- ...ycape-isolated-consumer-continuity-plan.md | 99 +++++++++++++++++++ ...0015-original-keycape-recovery-selector.md | 46 ++++++--- 2 files changed, 130 insertions(+), 15 deletions(-) create mode 100644 docs/keycape-isolated-consumer-continuity-plan.md diff --git a/docs/keycape-isolated-consumer-continuity-plan.md b/docs/keycape-isolated-consumer-continuity-plan.md new file mode 100644 index 0000000..6c89862 --- /dev/null +++ b/docs/keycape-isolated-consumer-continuity-plan.md @@ -0,0 +1,99 @@ +# Original KeyCape isolated consumer continuity plan + +Owner: secrets-engine. Source outcome: SECRETS-WP-0015-T03, 2026-10-17. +This is a reviewed source plan, not native assent, a custody grant or an +executed recovery. T04 remains a human wait on the complete NK49T33 attempt. + +The [frozen owner packet](../../the-custodian/docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/OWNER-PLAN.md) +contains the exact custody/command/negative/equality/timeout/abort plan and source +references. Its owner-plan SHA-256 is +`sha256:d358aaeedc18c42c591d3301ec34f493e63bf579bf5a17b6ccc7e32ec88ea8ed`. +The packet remains immutable; this source note does not revise its authority. + +## Exact original selector and source + +Use the existing [public selector](keycape-recovery-selector.json): issuer +`https://kc.coulomb.social`, client/audience `secrets-engine-openbao`, env name +`KEYCAPE_SECRETS_ENGINE_OPENBAO_CLIENT_SECRET`, subject +`service:secrets-engine`, tenant `tenant:platform`, exactly role +`secrets-engine`, scope `openbao:login`, denied scope `openbao:admin`. +The current consumer `service_auth.py` source SHA-256 is +`sha256:c0ade429edf452ad17f05d690b7ebef091db7f1a42b5ac350f1e40955c8586c0`. +Its existing AST-only selector preflight passes at that exact hash. Historical +issuer/consumer successes predate the archive and retain their historical scope. + +The packet's [one-shot observer candidate](../../the-custodian/docs/changes/netkingdom-target-2026-10-17/consumer-outage-r1/consumer_contract_observer.py) +is `sha256:23467730be61625d53b34c09e62f737a35e3def10d22a3a64664835961d3f4bd`. +Its frozen four-file consumer-source manifest is +`sha256:5b0409d7141514295e7d0f636ff6fa5dbe9d1f0d4d23b2f9ebce84a174d69499`. +The observer remains a source candidate: it was tested with synthetic unsigned +tokens only and is not installed, invoked on real material, or wired into either +NK49 recovery or ordinary consumer authentication. Five synthetic tests pass; +seven parser-negative variants and source/input refusal checks are within those +tests, not extra native successes. + +## Claims and custody boundaries + +1. **Original issuer:** the existing frozen NK49 native checker binds the + original archived registration/env, original TLS/trust/JWKS, wrong-secret and + excess-scope refusal, and exact original config/registry/policy/receipt + equality. Its receipt keeps downstream consumer reconnect false. +2. **Consumer claim compatibility:** after a newly reviewed NK49 source/admission + closure, the existing issuer `service-token` command may mint a short-lived + original-identity token in the issuer's private tmpfs. A reviewed same-session + wrapper would hand only that bounded token object over private stdin to the + exact Secrets claim observer, then prove transient-token/resource cleanup. + The original client secret stays in the restored issuer environment. Native + issuer/JWKS verification precedes consumer parsing; the observer verifies no + signature or native provenance. This proposed callback is not implemented. +3. **Full original OpenBao consumer continuity:** requires Platform/rapp-openbao's + independently recovered original backend/custody, original KV registration, + narrow OIDC source role and actual operator authentication/MFA dependencies, + plus exact isolated routing/trust. NK49's identity archive does not supply + OpenBao Raft recovery. A fresh backend, production login or injected secret + cannot substitute for this return. Then use the unchanged ordinary attended + OpenBao in-memory secret source, KeyCape exchange, actual OpenBao JWT login + and definite operator/engine session revocation. + +The current no-file/no-fallback direction remains. Do not inject the recovered +issuer secret into ordinary `login_service_jwt`, create a persistent consumer +copy, use ambient/bootstrap credentials, or redirect production. An exceptional +source would need a separate explicit owner/founder custody decision; none is +proposed or implemented here. Service identity/login-only policy is not protected +backend execution authority. SECRETS-WP-0008-T06/0013 retain those scopes; +finished SECRETS-WP-0012 remains finished. + +## Actual acceptance and next owner action + +The next action is to assemble NK49T33's exact owner-held original TLS/archive/ +private-admission packet and surviving offline founder authorization before any +key prompt. Matching hashes, possession of an archive key, this workplan and +historical CCRs are not that authorization. Bind exact source/image/executor, +original issuer/case/target, deadline and permitted isolated effects in the +existing supervised recovery process. No new auth or approval service is needed. + +Keep original ciphertext/transfer/source/binary/trust and manifest-binding-mode +interfaces. Private manifests and equality hashes stay inside custody. Freeze any +new observer callback/dependency closure, native command count and phase-specific +negative parsing; its source/synthetic lifecycle review must precede real input. +Use the existing bounded NK49 execution, exact pidfd/session quiescence and +registered tmpfs/container cleanup. Abort on unknown provenance, changed original +bytes, ambiguous daemon action or incomplete cleanup; preserve failed receipts +and uncertainty rather than retrying or reinitializing state. + +Require an actual positive original-issuer token and exact consumer claims, +including no extra roles. Native wrong-expected-audience/required-role refusals +are verifier checks, not OpenBao authorization. The observer's seven deliberately +modified payloads prove parser refusal only; unsigned mutations prove no signed +claim denial. Full backend acceptance separately requires real resource-server +wrong-audience/scope/role refusal, restored policy/role/KV equality and session +revocation through the existing owner path. Missing original signed negative +cases stay missing; do not create grants or claim signature failure isolates a +particular claim. A fresh attempt token is not a preserved pre-outage token. + +T04 remains wait/needs_human, depends on T03 and NK-WP-0049-T33, and retains +actual native acceptance. T18 owns actual selected-consumer recovery; T19 owns +retained-factor MFA. Return separate closed issuer/consumer-contract/backend +receipts tied to one attempt. Export source/public signing/TLS hashes, allowed +identifiers, booleans and cleanup facts only; never secret/token/private manifest +or raw provider output. A human wait is not an automatic worker wakeup. diff --git a/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md b/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md index 6b32638..9e1005e 100644 --- a/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md +++ b/workplans/SECRETS-WP-0015-original-keycape-recovery-selector.md @@ -4,7 +4,7 @@ type: workplan title: "Prepare original KeyCape service selector and isolated consumer continuity" domain: infotech repo: secrets-engine -status: ready +status: active owner: codex topic_slug: custodian created: "2026-10-17" @@ -17,8 +17,9 @@ state_hub_workstream_id: "68a0642e-4908-5260-89c9-3adce60e6a4d" Needed source-owner work for NK-WP-0049-T36/T18. Reviewed against current Lifecycle INTENT, explicit consumer constants/custody source and dated historical -proof. Ready means work can proceed, not native assent. Finished0012 remains -finished; functional adoption/backend entitlement stay0008T06/0013. No new grant, +proof. Active records the delivered source plan and remaining native owner wait; +it is not native assent. Finished0012 remains finished; functional adoption/backend +entitlement stay0008T06/0013. No new grant, secret fetch, provider login, production redirect or external message occurred. ## Establish exact current intended source selector @@ -61,22 +62,37 @@ is source correspondence, not native acceptance or a new secret source. ```task id: SECRETS-WP-0015-T03 -status: todo +status: done priority: high assignee: codex state_hub_task_id: "6262a915-7655-50be-b9f7-481f816d7335" ``` -Next: map the exact original archive-delivered registration and producer-native -checker result to the intended consumer, then prepare a source-reviewed isolated -proof/custody plan. Current consumer source requires attended OpenBao memory read -and refuses files; ordinary OpenBao/KeyCape outage is therefore a real dependency. -Do not add a fallback, persistent consumer copy or unreviewed injection source. -Clarify which continuity claim can be proved offline and which requires an exact -accepted owner custody/provider path. Bind current original selectors, image/ -source/TLS metadata, negative cases, timeout/abort and cleanup; retain protected -backend operation entitlement in existing0008/0013. Done when that exact plan and -remaining owner dependencies are reviewable, without retrieving any value. +Completed 2026-10-17 as source-plan preparation only. The reviewed owner plan +is [keycape-isolated-consumer-continuity-plan.md](../docs/keycape-isolated-consumer-continuity-plan.md), +bound to the frozen Custodian `consumer-outage-r1` packet. It distinguishes the +restored original issuer check, exact Secrets consumer claim compatibility and +actual original OpenBao consumer continuity, preserving the no-file/no-fallback +client-secret source contract. Offline founder authority, original TLS/private +admission, exact source/runtime/receipt interfaces, positive/negative/equality +oracles, timeout, abort and cleanup requirements are reviewable. The plan's done +criterion is met; no native or private custody dependency is represented as done. + +The packet includes an unexecuted-on-real-input one-shot claim observer candidate; +it is not wired into recovery or ordinary service authentication. Five synthetic +tests pass, including seven explicitly noncryptographic claim-parser negatives +and source/input refusal checks. The existing exact-source selector preflight +passes. These source checks establish neither token signature/native provenance +nor client-secret acquisition, OpenBao login, backend entitlement or downstream +reconnect. No private archive, original token/key, OpenBao endpoint or native +approval was accessed. Source integration/publication/projection are separate +coordinator follow-through; the immutable packet retains source hashes and limits. + +Remaining actual owner dependencies are explicit in the plan and T04: NK49T33 +complete original TLS/archive/private admission; an independently recovered +original OpenBao and its custody/OIDC/MFA graph for full consumer continuity; +exact native action approval and resource-server negative/revocation receipts. +Protected backend operation entitlement stays in existing0008T06/0013. ## Verify the separately admitted actual isolated consumer result @@ -87,7 +103,7 @@ priority: high assignee: codex needs_human: true depends_on: [SECRETS-WP-0015-T03, NK-WP-0049-T33] -blocking_reason: "Await exact consumer proof/custody plan plus original TLS/private admission readiness; actual attended owner path/authority remains required." +blocking_reason: "Source plan delivered in T03. Await NK-WP-0049-T33 original TLS/archive/private admission, exact native owner authority, and original OpenBao/custody recovery for actual consumer continuity." state_hub_task_id: "aeec6eb0-39e2-5f7c-8f5d-778133edfc73" ```